NESA compliance, DESC compliance, CBUAE cyber security rules, TDRA, PDPL — the UAE has several cybersecurity regimes, and they overlap enough to be genuinely confusing. Which one applies to you depends on your sector and who you serve, and it decides what testing you need and how often. This guide untangles them so you know exactly where you stand.
Your regulator follows your sector. Federal entities and critical infrastructure answer to NESA (UAE Information Assurance Standards) — NESA compliance is the federal baseline. Dubai government bodies and their suppliers answer to DESC. Banks, finance companies and payment providers answer to the CBUAE. Telecom and digital service providers fall under TDRA, and anyone processing personal data is covered by the UAE PDPL. In practice, nearly all of them expect vulnerability assessment and penetration testing (VAPT) at least annually.
| Regime | Who it applies to | Testing it expects | Frequency |
|---|---|---|---|
| NESA / UAE IA | Federal entities & critical-infrastructure operators | Vulnerability assessment & penetration testing in a managed programme | At least annually + after major changes |
| DESC (ISR) | Dubai government entities & their suppliers | Regular, independent testing with remediation evidence | Regular; risk-based |
| CBUAE | Banks, finance companies, exchange houses, payment providers | Vulnerability management & penetration testing; red teaming for mature programmes | Risk-based, often > annually |
| TDRA | Telecom & digital service providers | Security assurance for the services they run | Ongoing assurance |
| UAE PDPL | Any organisation processing personal data | Appropriate technical measures — testing to prove they work | Demonstrable & effective |
Start from your sector and who you serve.
The obligations differ, but the answers come from the same toolkit.
In short: NESA compliance covers federal and critical-infrastructure entities, DESC compliance covers Dubai government and its suppliers, and CBUAE cyber security requirements cover the financial sector. All three are satisfied by the same evidence — independent, well-reported VAPT, with red teaming for the mature programmes. Rootsec delivers exactly that from Business Bay, Dubai.
Keep reading, or go straight to the service that fits.
NESA sets the federal UAE Information Assurance Standards for government entities and critical-infrastructure operators nationwide. DESC is Dubai’s own regulator, whose Information Security Regulation applies to Dubai government entities and their suppliers. If you serve Dubai government from a critical sector, both can be relevant.
Yes. The UAE IA Standards NESA oversees expect regular vulnerability assessments and penetration testing as part of a managed security programme, typically at least annually and after significant changes.
CBUAE frameworks expect financial institutions to run a risk-based testing programme covering vulnerability management and penetration testing. More mature institutions are often expected to add red teaming or threat-led testing.
Often yes. A well-scoped VAPT with audit-ready reporting can produce evidence relevant to several regimes at once, provided the report maps findings to each framework you need. That mapping is where scoping matters.
At least annually plus after any major change is the common baseline for NESA and DESC. CBUAE-regulated firms often test more frequently on a risk basis. Our cost guide explains how frequency and scope affect the engagement.
Next step
Book a free 30-minute strategy call. You get clarity on scope, approach and a fixed price — no obligations.